marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

allow to specify image pull secrets for service accounts

Browse Source 
Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
This commit is contained in:
Pascal Sthamer
2025-02-21 10:44:49 +01:00
parent 53a7d2f2c4
commit 8263ba38aa
17 changed files with 248 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/shuffle/README.md
+6
View File
@@ -242,6 +242,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `backend.serviceAccount.imagePullSecrets` | Add image pull secrets to the backend service account | `[]` |
| `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `backend.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
@@ -359,6 +360,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `frontend.serviceAccount.imagePullSecrets` | Add image pull secrets to the frontend service account | `[]` |
| `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `frontend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
@@ -465,6 +467,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
| `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `orborus.serviceAccount.imagePullSecrets` | Add image pull secrets to the orborus service account | `[]` |
| `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `orborus.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
@@ -483,6 +486,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
@@ -498,6 +502,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
@@ -601,3 +606,4 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
### Other Parameters
charts/shuffle/templates/_helpers.tpl
+174 -12
View File
@@ -1,10 +1,3 @@
{{/*
Return the proper Docker Image Registry Secret Names
*/}}
{{- define "shuffle.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image .Values.frontend.image .Values.orborus.image .Values.worker.image .Values.volumePermissions.image) "context" $) -}}
{{- end -}}
{{/*
Return the common name for backend componentes
*/}}
@@ -136,6 +129,13 @@ Return the proper Shuffle backend image name
{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend pod
*/}}
{{- define "shuffle.backend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle frontend image name
*/}}
@@ -143,6 +143,13 @@ Return the proper Shuffle frontend image name
{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend pod
*/}}
{{- define "shuffle.frontend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle orborus image name
*/}}
@@ -150,6 +157,13 @@ Return the proper Shuffle orborus image name
{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus pod
*/}}
{{- define "shuffle.orborus.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle worker image name
*/}}
@@ -160,7 +174,7 @@ Return the proper Shuffle worker image name
{{/*
Create the name of the service account to use for the Shuffle backend
*/}}
{{- define "shuffle.backend.serviceAccountName" -}}
{{- define "shuffle.backend.serviceAccount.name" -}}
{{- if .Values.backend.serviceAccount.create -}}
{{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -168,10 +182,40 @@ Create the name of the service account to use for the Shuffle backend
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend service account
*/}}
{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.backend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle frontend
*/}}
{{- define "shuffle.frontend.serviceAccountName" -}}
{{- define "shuffle.frontend.serviceAccount.name" -}}
{{- if .Values.frontend.serviceAccount.create -}}
{{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -179,10 +223,40 @@ Create the name of the service account to use for the Shuffle frontend
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend service account
*/}}
{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.frontend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle orborus
*/}}
{{- define "shuffle.orborus.serviceAccountName" -}}
{{- define "shuffle.orborus.serviceAccount.name" -}}
{{- if .Values.orborus.serviceAccount.create -}}
{{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -190,10 +264,40 @@ Create the name of the service account to use for Shuffle orborus
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus service account
*/}}
{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.orborus.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle workers
*/}}
{{- define "shuffle.worker.serviceAccountName" -}}
{{- define "shuffle.worker.serviceAccount.name" -}}
{{- if .Values.worker.serviceAccount.create -}}
{{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -201,10 +305,40 @@ Create the name of the service account to use for Shuffle workers
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the worker service account
*/}}
{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.worker.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle apps
*/}}
{{- define "shuffle.app.serviceAccountName" -}}
{{- define "shuffle.app.serviceAccount.name" -}}
{{- if .Values.app.serviceAccount.create -}}
{{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -212,4 +346,32 @@ Create the name of the service account to use for Shuffle apps
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the app service account
*/}}
{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.app.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
charts/shuffle/templates/backend/backend-dpl.yaml
+2 -2
View File
@@ -25,8 +25,8 @@ spec:
{{- end }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.backend.serviceAccountName" . }}
{{- include "shuffle.backend.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.backend.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }}
{{- if .Values.backend.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }}
charts/shuffle/templates/backend/backend-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.backend.serviceAccountName" . }}
name: {{ include "shuffle.backend.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/backend/backend-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.backend.serviceAccountName" . }}
name: {{ include "shuffle.backend.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.backend.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/frontend/frontend-dpl.yaml
+2 -2
View File
@@ -25,8 +25,8 @@ spec:
{{- end }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.frontend.serviceAccountName" . }}
{{- include "shuffle.frontend.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.frontend.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }}
{{- if .Values.frontend.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }}
charts/shuffle/templates/frontend/frontend-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.frontend.serviceAccountName" . }}
name: {{ include "shuffle.frontend.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.frontend.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/orborus/orborus-cm-env.yaml
+1 -1
View File
@@ -13,7 +13,7 @@ data:
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccountName" . }}
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }}
SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
SHUFFLE_SWARM_CONFIG: run
charts/shuffle/templates/orborus/orborus-dpl.yaml
+4 -4
View File
@@ -25,8 +25,8 @@ spec:
{{- end }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.orborus.serviceAccountName" . }}
{{- include "shuffle.orborus.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.orborus.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }}
{{- if .Values.orborus.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }}
@@ -87,9 +87,9 @@ spec:
- name: IS_KUBERNETES
value: "true"
- name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.worker.serviceAccountName" . }}
value: {{ include "shuffle.worker.serviceAccount.name" . }}
- name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.app.serviceAccountName" . }}
value: {{ include "shuffle.app.serviceAccount.name" . }}
{{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
charts/shuffle/templates/orborus/orborus-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.orborus.serviceAccountName" . }}
name: {{ include "shuffle.orborus.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/orborus/orborus-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.orborus.serviceAccountName" . }}
name: {{ include "shuffle.orborus.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.orborus.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.app.serviceAccountName" . }}
name: {{ include "shuffle.app.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.app.serviceAccountName" . }}
name: {{ include "shuffle.app.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.app.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.worker.serviceAccountName" . }}
name: {{ include "shuffle.worker.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.worker.serviceAccountName" . }}
name: {{ include "shuffle.worker.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.worker.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/values.schema.json
+30
View File
@@ -715,6 +715,12 @@
"type": "boolean",
"description": "Automount service account token for the server service account",
"default": true
},
"imagePullSecrets": {
"type": "array",
"description": "Add image pull secrets to the backend service account",
"default": [],
"items": {}
}
}
},
@@ -1398,6 +1404,12 @@
"type": "boolean",
"description": "Automount service account token for the server service account",
"default": true
},
"imagePullSecrets": {
"type": "array",
"description": "Add image pull secrets to the frontend service account",
"default": [],
"items": {}
}
}
},
@@ -2011,6 +2023,12 @@
"type": "boolean",
"description": "Automount service account token for the server service account",
"default": true
},
"imagePullSecrets": {
"type": "array",
"description": "Add image pull secrets to the orborus service account",
"default": [],
"items": {}
}
}
},
@@ -2103,6 +2121,12 @@
"type": "boolean",
"description": "Automount service account token for the server service account",
"default": true
},
"imagePullSecrets": {
"type": "array",
"description": "Add image pull secrets to the worker service account",
"default": [],
"items": {}
}
}
},
@@ -2175,6 +2199,12 @@
"type": "boolean",
"description": "Automount service account token for the server service account",
"default": true
},
"imagePullSecrets": {
"type": "array",
"description": "Add image pull secrets to the app service account",
"default": [],
"items": {}
}
}
},
charts/shuffle/values.yaml
+15
View File
@@ -456,6 +456,9 @@ backend:
## @param backend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account
##
automountServiceAccountToken: true
## @param backend.serviceAccount.imagePullSecrets Add image pull secrets to the backend service account
##
imagePullSecrets: []
## RBAC configuration
##
@@ -921,6 +924,9 @@ frontend:
## @param frontend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account
##
automountServiceAccountToken: true
## @param frontend.serviceAccount.imagePullSecrets Add image pull secrets to the frontend service account
##
imagePullSecrets: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
@@ -1322,6 +1328,9 @@ orborus:
## @param orborus.serviceAccount.automountServiceAccountToken Automount service account token for the server service account
##
automountServiceAccountToken: true
## @param orborus.serviceAccount.imagePullSecrets Add image pull secrets to the orborus service account
##
imagePullSecrets: []
## RBAC configuration
##
@@ -1393,6 +1402,9 @@ worker:
## @param worker.serviceAccount.automountServiceAccountToken Automount service account token for the server service account
##
automountServiceAccountToken: true
## @param worker.serviceAccount.imagePullSecrets Add image pull secrets to the worker service account
##
imagePullSecrets: []
## RBAC configuration
##
@@ -1461,6 +1473,9 @@ app:
## istio: pilot
##
automountServiceAccountToken: true
## @param app.serviceAccount.imagePullSecrets Add image pull secrets to the app service account
##
imagePullSecrets: []
## RBAC configuration
##